67 matches found
Apache HTTP Optionsbleed Memory Leak (CVE-2017-9798)
A use afetr free vulnerability exuists in Apache HTTP Server. A remote attacker can exploit this issue by sending an OPTIONS request to the vulnerable system. A successful attack may lead to memory leakage and loss of private data...
CVE-2017-9798: Use After Free
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker...
Fixed in Apache Tomcat 9.0.0.M21
Important: Security Constraint Bypass CVE-2017-5664 The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the...
CVE-2014-2288: Improper Input Validation
The PJSIP channel driver in Asterisk Open Source 12.x before 12.1.1, when qualifyfrequency "is enabled on an AOR and the remote SIP server challenges for authentication of the resulting OPTIONS request," allows remote attackers to cause a denial of service crash via a PJSIP endpoint that does not...
Fedora 19 : subversion-1.7.16-1.fc19 (2014-3567)
This update includes the latest stable release of Apache Subversion 1.7, fixing a security issue CVE-2014-0032 : Subversion's moddavsvn Apache HTTPD server module will crash when it receives an OPTIONS request against the server root and Subversion is configured to handle the server root and...
MGASA-2014-0105 Updated subversion packages fix CVE-2014-0032
Updated subversion packages fix security vulnerability: The moddavsvn module in Apache Subversion before 1.8.8, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service crash via an OPTIONS request CVE-2014-0032. The package has been updated to version 1.8.8, which...
MGASA-2014-0104 Updated subversion packages fix CVE-2014-0032
Updated subversion packages fix security vulnerability: The moddavsvn module in Apache Subversion before 1.8.8, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service crash via an OPTIONS request CVE-2014-0032. The package has been patched to correct this issue...
subversion -- mod_dav_svn vulnerability
Subversion Project reports: Subversion's moddavsvn Apache HTTPD server module will crash when it receives an OPTIONS request against the server root and Subversion is configured to handle the server root and SVNListParentPath is on. This can lead to a DoS. There are no known instances of this...
Nmap NSE net: http-methods
Finds out what options are supported by an HTTP server by sending an OPTIONS request. Lists potentially risky methods. Optionally tests each method individually to see if they are subject to e.g. IP address restrictions. In this script, 'potentially risky' methods are anything except GET, HEAD,...
Sun Java Web Server - System WebDAV OPTIONS Buffer Overflow (Metasploit)
$Id: sunjswsdavoptions.rb 9971 2010-08-07 06:59:16Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...
Sun Java System Web Server Multiple Vulnerabilities - Windows
Sun Java Web Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
http-methods NSE Script
Finds out what options are supported by an HTTP server by sending an OPTIONS request. Lists potentially risky methods. It tests those methods not mentioned in the OPTIONS headers individually and sees if they are implemented. Any output other than 501/405 suggests that the method is if not in the...
Stack overflow
Stack-based buffer overflow in the WebDAV implementation in webservd in Sun Java System Web Server aka SJWS 7.0 Update 7 allows remote attackers to cause a denial of service daemon crash and possibly have unspecified other impact via a long URI in an HTTP OPTIONS request...
CVE-2010-0361
Stack-based buffer overflow in the WebDAV implementation in webservd in Sun Java System Web Server aka SJWS 7.0 Update 7 allows remote attackers to cause a denial of service daemon crash and possibly have unspecified other impact via a long URI in an HTTP OPTIONS request...
CVE-2009-2816: Cross-Site Request Forgery (CSRF)
The implementation of Cross-Origin Resource Sharing CORS in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight, which makes it easier for remote attackers to...
Stable Update: Fix Google Chrome not Starting
Google Chrome's Stable channel has been updated to 3.0.195.33 to fix a potential issue that could cause Google Chrome to stop working and a security issue. This release removes a dependency on a Windows library t2embed.dll that is not required by Google Chrome. If that library is missing or the...
CVE-2009-3457
Cisco ACE XML Gateway AXG and ACE Web Application Firewall WAF before 6.1 allow remote attackers to obtain sensitive information via an HTTP request that lacks a handler, as demonstrated by 1 an OPTIONS request or 2 a crafted GET request, leading to a Message-handling Errors message containing a...
Cisco应用控制引擎(ACE) XML网关IP地址信息泄漏漏洞
Bugraq ID: 36522 Cisco ACE XML网关是Cisco应用控制引擎ACE家族产品的重要组件。 Cisco ACE XML网关缺少正确的错误处理管理，远程攻击者可以利用漏洞获得内部IP信息。 Cisco ACE XML网关在不能正确找到请求相匹配的处理器时，会直接对客户端提供包含内部IP地址的错误消息应答。 相关的请求不仅仅限于OPTIONS请求类型，如果GET请求使用的路径没有相应的处理器配置，也同样泄漏内部IP地址信息。 Cisco Application Control Engine ACE XML Gateway 6.0 Cisco Application...